CVE-2026-15667

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is affected by a Local File Inclusion vulnerability in all versions up to and including 4.1.22 , exploitable via the event_layout parameter. Because the etn_manage_event capability is assigned to...

CVE-2026-15667 Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with...

EUVD-2026-74568

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with custom-level...

EUVD-2026-74173

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...

CVE-2026-55634 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/id/import accepts a DataObject field name that is emitted without an identifier allowlist b...

CVE-2026-54718

Silverstripe Advanced Workflow (the symbiote/silverstripe-advancedworkflow module) is vulnerable to remote code execution prior to versions 6.4.5, 7.1.3, and 7.2.1. An attacker with permission to author the advanced workflow email template can inject a specially crafted server-side template paylo...

CVE-2026-54718 Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

WordPress Create Block Theme plugin < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite) vulnerability

Admin+ PHP Code Injection via Pattern Save Multisite vulnerability discovered by Pavan Saxena Rootkid in WordPress Plugin Create Block Theme versions 2.10.0...

CVE-2026-78562

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2026-78566

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

EUVD-2026-65326

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

CVE-2026-78566

...

EUVD-2026-65325

The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used...

CVE-2026-78478

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypas...

CVE-2026-78478

The Måne theme for WordPress is affected by an unauthenticated Local File Inclusion vulnerability in all versions up to and including 1.7 . An attacker can include and execute arbitrary files on the server, enabling execution of any PHP code within those files. This can be leveraged to bypass acc...

CVE-2026-78478 Måne <= 1.7 - Unauthenticated Local File Inclusion

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypas...

CVE-2026-14280 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...

PT-2026-81178

Name of the Vulnerable Software and Affected Versions Mane theme for WordPress versions prior to 1.8 Description The Mane theme for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, which can lead to the...

PT-2026-81217

Name of the Vulnerable Software and Affected Versions Verdure Core versions prior to 1.3 Description The Verdure Core plugin for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, enabling the execution of PH...

CVE-2026-59989 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...